Microsoft announces SQL-injection Exploit

On Monday Microsoft warned that a security researcher had published an exploit for an un-patched flaw in the SQL database software.

SecurityOrb.com researchers published:

"The information could allow malicious attackers the ability to compromise Web sites that use Microsoft's software to serve up dynamic Web pages. The vulnerability affects older versions of the software, including Microsoft SQL Server 2000, Microsoft SQL Server 2005, Microsoft SQL Server 2005 Express Edition, Microsoft SQL Server 2000 Desktop Engine, Microsoft SQL Server 2000 Desktop Engine and Windows Internal Database, the company said in an advisory."

Vulnerability Report

Vulnerability:aspportal
Published:2008-11-28
Severity:High
Description:SQL injection vulnerability in content/forums/reply.asp in ASPPortal allows remote attackers to execute arbitrary SQL commands via the Topic_Id parameter.
Recommendation: NA